Re: Hard Drive Access

Article View: borland.public.cppbuilder.nativeapi

Article #280

Back to borland.public.cppbuilder.nativeapi Previous Next

#280

From: Mike Collins
Date: Tue, 27 May 2008 15:39

21 lines
1738 bytes

I might be total wrong here, but I'm sure that when i looked at FileMon (the 
most recent version) it use a file system driver that it unpacks on the fly. 
Not sure where Bruces code came from - maybe he was one of those guys who 
was lucky enough to grab a copy before SysInternals when over to Microsoft 
and they stopped giving source code.

Anyway, as Bruce has said, you can construct an api hooking system which 
should give you some notification of when certain *file* related api's are 
called.

I can give you some direction on this if you wish to e-mail me directly.  We 
use DLL injection and APi hooking quite a lot and i'd be happy to point you 
in the right direction.  If you want to e-mail me my address is mike (at) 
kid-safe (dot) co (uk)

Best regards,

Mike


>

Technical Details

Message-ID: <483c1a7e$1@newsgroups.borland.com>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.glorb.com!feeder.erje.net!newsfeed.straub-nv.de!newsfeed01.sul.t-online.de!t-online.de!newsgroups.borland.com!not-for-mail

References: <483726af$1@newsgroups.borland.com> <483978fa@newsgroups.borland.com>

Show Full Headers

Complete Article Headers

X-Google-Thread: 10cc67,c374cfd4b7ac43da
X-Google-Attributes: gid10cc67,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
From: "Mike Collins" <its@TheBottomOfThePost>
Newsgroups: borland.public.cppbuilder.nativeapi
References: <483726af$1@newsgroups.borland.com> <483978fa@newsgroups.borland.com>
Subject: Re: Hard Drive Access
Date: Tue, 27 May 2008 15:39:39 -0000
Lines: 23
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.3790.3959
X-RFC2646: Format=Flowed; Response
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4133
NNTP-Posting-Host: 78.148.58.161
Message-ID: <483c1a7e$1@newsgroups.borland.com>
X-Trace: newsgroups.borland.com 1211898494 78.148.58.161 (27 May 2008 07:28:14 -0700)
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.glorb.com!feeder.erje.net!newsfeed.straub-nv.de!newsfeed01.sul.t-online.de!t-online.de!newsgroups.borland.com!not-for-mail

Reply to Parent Message